54 #define PARSE_REGEX "^\\s*!?([^\\s,]+)\\s*(,\\s*relative)?\\s*(,\\s*rawbytes\\s*)?\\s*$"
60 static void DetectIsdataatRegisterTests(
void);
61 static void DetectAbsentRegisterTests(
void);
85 }
else if (strcmp(optstr,
"or_else") == 0) {
88 SCLogError(
"unhandled value for absent keyword: %s", optstr);
92 SCLogError(
"unspected buffer for absent keyword");
97 SCLogError(
"absent does not work with frames");
101 SCLogError(
"absent must come first right after buffer");
112 DetectAbsentFree(
de_ctx, dad);
120 bool has_other =
false;
121 bool only_absent =
false;
122 bool has_absent =
false;
135 SCLogError(
"signature can't have absent and fast_pattern on the same buffer");
142 if (only_absent && has_other) {
143 SCLogError(
"signature can't have a buffer tested absent and tested with other keywords "
146 }
else if (has_absent && !only_absent && !has_other) {
148 "signature with absent: or_else expects other keywords to test on such as content");
200 char *args[3] = {NULL,NULL,NULL};
205 pcre2_match_data *match = NULL;
207 if (ret < 1 || ret > 4) {
208 SCLogError(
"pcre_exec parse error, ret %" PRId32
", string %s", ret, isdataatstr);
214 res = pcre2_substring_get_bynumber(match, 1, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len);
216 SCLogError(
"pcre2_substring_get_bynumber failed");
219 args[0] = (
char *)str_ptr;
223 res = pcre2_substring_get_bynumber(match, 2, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len);
225 SCLogError(
"pcre2_substring_get_bynumber failed");
228 args[1] = (
char *)str_ptr;
231 res = pcre2_substring_get_bynumber(match, 3, (PCRE2_UCHAR8 **)&str_ptr, &pcre2_len);
233 SCLogError(
"pcre2_substring_get_bynumber failed");
236 args[2] = (
char *)str_ptr;
246 if (args[0][0] !=
'-' && isalpha((
unsigned char)args[0][0])) {
249 "var name for offset. \"offset\" argument supplied to "
250 "this function has to be non-NULL");
258 strlen(args[0]), args[0]) < 0 ) {
266 if (args[1] !=NULL) {
273 if (isdataatstr[0] ==
'!') {
277 for (i = 0; i < (ret -1); i++) {
279 pcre2_substring_free((PCRE2_UCHAR8 *)args[i]);
282 pcre2_match_data_free(match);
289 pcre2_match_data_free(match);
291 for (i = 0; i < (ret -1) && i < 3; i++){
293 pcre2_substring_free((PCRE2_UCHAR8 *)args[i]);
319 idad = DetectIsdataatParse(
de_ctx, isdataatstr, &
offset);
352 "seen in isdataat - %s\n",
384 if (prev_pm == NULL) {
427 "preceding content option");
442 static int g_dce_stub_data_buffer_id = 0;
448 static int DetectIsdataatTestParse01 (
void)
452 idad = DetectIsdataatParse(NULL,
"30 ", NULL);
465 static int DetectIsdataatTestParse02 (
void)
469 idad = DetectIsdataatParse(NULL,
"30 , relative", NULL);
482 static int DetectIsdataatTestParse03 (
void)
486 idad = DetectIsdataatParse(NULL,
"30,relative, rawbytes ", NULL);
498 static int DetectIsdataatTestParse04(
void)
524 static int DetectIsdataatTestParse06(
void)
531 "(msg:\"Testing bytejump_body\"; "
533 "isdataat:!4,relative; sid:1;)");
547 "(msg:\"Testing bytejump_body\"; "
549 "isdataat: !4,relative; sid:2;)");
569 static int DetectIsdataatTestPacket01 (
void)
572 uint8_t *buf = (uint8_t *)
"Hi all!";
573 uint16_t buflen = strlen((
char *)buf);
579 if (p[0] == NULL || p[1] == NULL ||p[2] == NULL)
583 sigs[0]=
"alert ip any any -> any any (msg:\"Testing window 1\"; isdataat:6; sid:1;)";
584 sigs[1]=
"alert ip any any -> any any (msg:\"Testing window 2\"; content:\"all\"; isdataat:1, relative; isdataat:6; sid:2;)";
585 sigs[2]=
"alert ip any any -> any any (msg:\"Testing window 3\"; isdataat:8; sid:3;)";
586 sigs[3]=
"alert ip any any -> any any (msg:\"Testing window 4\"; content:\"Hi\"; isdataat:5, relative; sid:4;)";
587 sigs[4]=
"alert ip any any -> any any (msg:\"Testing window 4\"; content:\"Hi\"; isdataat:6, relative; sid:5;)";
589 uint32_t sid[5] = {1, 2, 3, 4, 5};
591 uint32_t results[3][5] = {
599 result =
UTHGenericTest(p, 3, sigs, sid, (uint32_t *) results, 5);
611 static int DetectIsdataatTestPacket02 (
void)
614 uint8_t *buf = (uint8_t *)
"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0"
615 "User-Agent: Wget/1.11.4"
617 "Host: www.google.com"
618 "Connection: Keep-Alive"
619 "Date: Mon, 04 Jan 2010 17:29:39 GMT";
620 uint16_t buflen = strlen((
char *)buf);
627 char sig[] =
"alert tcp any any -> any any (msg:\"pcre with"
628 " isdataat + relative\"; pcre:\"/A(ll|pp)WorkAndNoPlayMakesWillA"
629 "DullBoy/\"; isdataat:96,relative; sid:1;)";
643 static int DetectIsdataatTestPacket03 (
void)
646 uint8_t *buf = (uint8_t *)
"GET /AllWorkAndNoPlayMakesWillADullBoy HTTP/1.0"
647 "User-Agent: Wget/1.11.4"
649 "Host: www.google.com"
650 "Connection: Keep-Alive"
651 "Date: Mon, 04 Jan 2010 17:29:39 GMT";
652 uint16_t buflen = strlen((
char *)buf);
659 char sig[] =
"alert tcp any any -> any any (msg:\"byte_jump match = 0 "
660 "with distance content HTTP/1. relative against HTTP/1.0\"; byte_jump:1,"
661 "46,string,dec; isdataat:87,relative; sid:109; rev:1;)";
673 void DetectIsdataatRegisterTests(
void)
677 UtRegisterTest(
"DetectIsdataatTestParse01", DetectIsdataatTestParse01);
678 UtRegisterTest(
"DetectIsdataatTestParse02", DetectIsdataatTestParse02);
679 UtRegisterTest(
"DetectIsdataatTestParse03", DetectIsdataatTestParse03);
680 UtRegisterTest(
"DetectIsdataatTestParse04", DetectIsdataatTestParse04);
681 UtRegisterTest(
"DetectIsdataatTestParse06", DetectIsdataatTestParse06);
683 UtRegisterTest(
"DetectIsdataatTestPacket01", DetectIsdataatTestPacket01);
684 UtRegisterTest(
"DetectIsdataatTestPacket02", DetectIsdataatTestPacket02);
685 UtRegisterTest(
"DetectIsdataatTestPacket03", DetectIsdataatTestPacket03);
688 static int DetectAbsentTestParse01(
void)
695 "alert http any any -> any any "
696 "(msg:\"invalid absent only with negated content\"; http.user_agent; "
697 "absent; content:!\"one\"; sid:2;)");
700 "(msg:\"invalid absent\"; http.user_agent; "
701 "content:!\"one\"; absent; sid:2;)");
704 "(msg:\"invalid absent\"; http.user_agent; "
705 "content:\"one\"; absent: or_else; sid:2;)");
708 "(msg:\"absent without sticky buffer\"; "
709 "content:!\"one\"; absent: or_else; sid:2;)");
712 "alert websocket any any -> any any "
713 "(msg:\"absent with frame\"; "
714 "frame: websocket.pdu; absent: or_else; content:!\"one\"; sid:2;)");
720 void DetectAbsentRegisterTests(
void)
722 UtRegisterTest(
"DetectAbsentTestParse01", DetectAbsentTestParse01);